8.1 IP Routing Principles and Packet Forwarding

IP Routing Principles and Packet Forwarding

Quick Summary: While Layer 2 switching forwards frames within a single broadcast domain using MAC addresses, Layer 3 routing connects disparate networks and forwards packets based on destination IP addresses. An enterprise Layer 3 switch evaluates routing decisions through a strict three-tier hierarchy: Longest Prefix Match (LPM) first, followed by Administrative Distance (AD) to choose between different routing protocols, and finally protocol-specific metrics to pick the best path within a single protocol. Once a path is chosen, the switch performs critical transit header transformations—decrementing the IPv4 Time-to-Live (TTL), recomputing the IP header checksum, and completely replacing the Layer 2 Ethernet encapsulation with new source and destination MAC addresses.

---

Layer 2 Switching vs. Layer 3 Routing

In modern campus architectures, access-layer switches isolate end-user devices into separate Virtual Local Area Networks (VLANs). Because each VLAN constitutes an independent Layer 2 broadcast domain, hosts residing in different VLANs cannot communicate through standard MAC learning and forwarding mechanisms. Bridging frames across broadcast domains would defeat the security, segmentation, and performance benefits of VLANs.

Inter-VLAN communication requires a Layer 3 routing device—either a dedicated physical router or a multilayer switch running Aruba AOS-CX with active Switched Virtual Interfaces (SVIs) or routed ports. Key distinctions include:

• Addressing Scope: Layer 2 switches examine 48-bit hardware MAC addresses (flat addressing) contained in Ethernet frame headers. Layer 3 routers examine 32-bit IPv4 or 128-bit IPv6 addresses (hierarchical network addressing) located within the Network layer packet header.
• Broadcast Containment: Layer 2 switches flood broadcast frames (such as ARP requests and DHCP Discovers) out all ports in the broadcast domain. Layer 3 routers terminate broadcast domains; they do not forward Layer 2 broadcast frames across routed boundaries.
• Forwarding Logic: A switch forwards traffic based on its dynamic MAC address table (CAM table). A router forwards traffic by performing lookups against its Routing Information Base (RIB) and hardware-accelerated Forwarding Information Base (FIB).

---

The Route Selection Hierarchy

When a router receives an IP packet destined for a remote host, it consults its routing table to determine the egress interface and the next-hop IP address. If multiple routes exist in the routing table, the router applies a deterministic three-step evaluation order.

+-----------------------------------------------------------------------------------+
|                         ROUTE SELECTION EVALUATION ORDER                         |
|                                                                                   |
|  1. LONGEST PREFIX MATCH (LPM)                                                    |
|     Evaluates subnet mask length (/32 > /28 > /24 > /16 > /0).                    |
|     The most specific route ALWAYS wins, regardless of AD or metric!              |
|                                      |                                            |
|                                      v (Tie in prefix length)                     |
|  2. ADMINISTRATIVE DISTANCE (AD) / ROUTE PREFERENCE                               |
|     Compares reliability of different route sources learning the SAME prefix.      |
|     Lowest numerical AD wins (Connected: 0, Static: 1, eBGP: 20, OSPF: 110).     |
|                                      |                                            |
|                                      v (Same prefix AND same protocol/AD)         |
|  3. METRIC / PATH COST                                                            |
|     Compares paths learned from the SAME routing protocol.                        |
|     Lowest metric wins (e.g., OSPF lowest cumulative interface cost).             |
+-----------------------------------------------------------------------------------+

1. Longest Prefix Match (LPM)

The foremost rule of IP routing is Longest Prefix Match (LPM). The router identifies all routing table entries that match the destination IP address of the packet and selects the entry with the longest prefix length (most specific subnet mask).

Consider a router that holds the following four routes in its routing table:

• Route A: 10.0.0.0/8 (via 192.168.1.1)
• Route B: 10.1.0.0/16 (via 192.168.2.1)
• Route C: 10.1.1.0/24 (via 192.168.3.1)
• Route D: 10.1.1.128/28 (via 192.168.4.1)
• Route E: 0.0.0.0/0 (Default route via 192.168.5.1)

If a packet arrives destined for host 10.1.1.135:

1. The binary representation of 10.1.1.135 matches routes A, B, C, D, and E.
2. Route D has a prefix length of /28 (28 matching network bits), which is longer than /24, /16, /8, or /0.
3. The router forwards the packet to next-hop 192.168.4.1 via Route D.

Critical Exam Rule: Longest Prefix Match overrides Administrative Distance. An OSPF route with prefix length /28 (AD 110) will always be chosen over a Static Route with prefix length /24 (AD 1) when forwarding to an IP address that falls within the /28 boundary.

2. Administrative Distance (AD) / Route Preference

When multiple routing processes (or static configuration) advertise the exact same destination prefix and mask (for example, both OSPF and a static route learn 172.16.10.0/24), the router cannot install both into the active routing table based on prefix length. It uses Administrative Distance (AD)—also called route preference—to determine which source is more trustworthy.

Administrative Distance is an integer value between 0 and 255. A lower numerical value indicates higher trustworthiness.

If an administrator configures a static route to 192.168.50.0/24 with AD 1, and OSPF also advertises 192.168.50.0/24 with AD 110, the switch installs the static route into the routing table. The OSPF route remains in the OSPF database as a backup.

3. Routing Metrics

When a single routing protocol learns multiple paths to the exact same prefix, Administrative Distance is identical. The protocol evaluates its internal metric to break the tie:

• OSPF: Uses Cost, inversely proportional to link bandwidth (Cost = Reference Bandwidth / Interface Bandwidth). The path with the lowest cumulative cost wins.
• RIP: Uses Hop Count (number of routers traversed; maximum 15 hops).
• BGP: Uses a multi-attribute decision process (Weight, Local Preference, AS Path length, Origin, MED).

If multiple paths have identical prefix length, identical AD, and identical metric, the router performs Equal-Cost Multi-Path (ECMP) load balancing.

---

The Transit Packet Forwarding Lifecycle

When a Layer 3 switch receives a unicast Ethernet frame whose destination MAC address matches the switch's local SVI or routed port, the switch terminates the Layer 2 encapsulation and routes the Layer 3 payload.

[ Host A: 10.1.1.50 ]              [ Aruba CX Switch ]              [ Host B: 10.2.2.80 ]
 MAC: aaaa.aaaa.aaaa              In Port: 1/1/1  Out Port: 1/1/2     MAC: bbbb.bbbb.bbbb
                              MAC: cccc.cccc.1111  MAC: cccc.cccc.2222

   1. Host A encapsulates packet:      2. Switch validates FCS,        4. Host B receives frame:
      - Src MAC: aaaa.aaaa.aaaa           strips L2 header.               - Src MAC: cccc.cccc.2222
      - Dst MAC: cccc.cccc.1111        3. Switch rewrites header:         - Dst MAC: bbbb.bbbb.bbbb
      - Src IP:  10.1.1.50                - Decrements TTL (-1)           - Src IP:  10.1.1.50
      - Dst IP:  10.2.2.80                - Recomputes Checksum           - Dst IP:  10.2.2.80
                                          - Src MAC: cccc.cccc.2222
                                          - Dst MAC: bbbb.bbbb.bbbb

The packet forwarding lifecycle proceeds through seven sequential stages:

1. Ingress Frame Validation: The physical interface receives the electrical or optical signal and verifies the Frame Check Sequence (FCS) in the Ethernet trailer. If corrupted, the frame is dropped immediately.
2. Layer 2 De-encapsulation: The switch inspects the Destination MAC address. If the MAC matches the switch's local ingress interface or SVI, the switch recognizes itself as the intended Layer 2 receiver. It strips the Ethernet preamble, MAC headers, and FCS trailer, extracting the IPv4 packet.
3. IP Header Verification & TTL Decrement: The switch validates the IPv4 header checksum. Next, it inspects the Time-to-Live (TTL) field:
   • The TTL field prevents packets from circulating indefinitely during routing loops.
   • The switch decrements TTL by 1 (TTL = TTL - 1).
   • If the decremented TTL equals 0, the packet is discarded, and the switch generates an ICMP Time Exceeded (Type 11, Code 0) message sent back to the source IP.
   • Because the TTL changed, the switch recalculates the IPv4 header checksum.
4. Routing Table Lookup (FIB Lookup): The switch evaluates the destination IP address against its Forwarding Information Base (FIB) using Longest Prefix Match to determine the egress interface and next-hop IP address.
5. Next-Hop Layer 2 Resolution (ARP Lookup): To re-encapsulate the packet, the switch requires the Layer 2 MAC address of the next hop (either the final destination host on a directly connected subnet or an upstream router). The switch consults its Address Resolution Protocol (ARP) cache:
   • If an ARP entry exists, the switch retrieves the destination MAC address.
   • If no entry exists, the switch buffers the packet and broadcasts an ARP Request (Who has <next-hop-ip>? Tell <switch-ip>).
6. Layer 2 Re-encapsulation: The switch constructs a brand-new Ethernet header:
   • Source MAC: Rewritten to the MAC address of the switch's egress interface or SVI.
   • Destination MAC: Set to the MAC address of the resolved next hop or destination host.
   • EtherType: Set to 0x0800 (IPv4) or 0x86DD (IPv6).
   • Frame Check Sequence (FCS): A new CRC32 checksum is calculated and appended to the frame trailer.
7. Egress Transmission: The newly encapsulated frame is queued in the egress port's hardware buffer and transmitted onto the physical medium.

---

Hardware Acceleration: RIB vs. FIB

In modern enterprise switches such as the Aruba CX 6200, 6300, and 6400 series, packet forwarding does not involve the switch CPU for every packet. Instead, AOS-CX decouples the control plane from the data plane:

• Control Plane — Routing Information Base (RIB): Maintained in system RAM by the switch CPU and operating system routing daemons. Contains all routes learned from all sources (Connected, Static, OSPF, BGP). The CPU resolves conflicts using AD and metrics, generating the active forwarding table.
• Data Plane — Forwarding Information Base (FIB): Downloaded directly from the RIB into high-speed Application-Specific Integrated Circuit (ASIC) hardware tables known as Ternary Content-Addressable Memory (TCAM). TCAM performs line-rate, hardware-accelerated Longest Prefix Match lookups in parallel in a single clock cycle, enabling multi-terabit switching performance.

---

AOS-CX CLI Verification Commands

The following commands verify routing table installation, ARP mappings, and forwarding states on AOS-CX:

switch# show ip route
Displaying ipv4 routes selected for forwarding
'[x/y]' denotes [preference/metric]

0.0.0.0/0, vrf default
        via 10.0.1.1, [1/0], static
10.0.1.0/24, vrf default
        via 1/1/48, [0/0], connected
10.10.10.0/24, vrf default
        via vlan10, [0/0], connected
10.20.0.0/16, vrf default
        via 10.0.1.2, [110/20], ospf
10.20.10.0/24, vrf default
        via 10.0.1.3, [110/10], ospf

Key Verification Table

---

Common Exam Traps

• LPM vs. Administrative Distance: Exam questions frequently present a static default route (0.0.0.0/0, AD 1) and an OSPF route to a specific subnet (10.5.0.0/16, AD 110). Candidates incorrectly choose the static route because AD 1 is lower than AD 110. The correct forwarding path is OSPF because /16 is a longer prefix match than /0.
• IP vs. MAC Header Rewrites: In standard unicast routing, the Source IP and Destination IP addresses never change across transit hops. Only the Source MAC and Destination MAC addresses are replaced at each Layer 3 boundary.
• TTL Threshold: A packet with a TTL of 1 is discarded when it reaches a router that must forward it to another network. The router decrements TTL from 1 to 0 and drops the packet; it does not forward a packet with TTL 0.